How to Check if an Email Address Is Valid (Without Sending an Email)

A bad email address is expensive in quiet ways. A lead you never reach, a welcome email that bounces, a free trial claimed for the fifth time with a throwaway inbox. Send to enough bad addresses and mailbox providers start treating your real emails as spam too. The good news is that you can learn a lot about an address without sending a single message.

What you can check without sending an email

Every useful check works from the address itself and public DNS records. In order of how much they catch:

1. Syntax

An address has a local part, an @ and a domain. The local part may be up to 64 characters and the whole address up to 254. Spaces, two @ signs, a dot at the start or end of the local part and two dots in a row are all invalid. Most broken addresses fail here, usually because of a copy-paste accident: a trailing comma from a spreadsheet, a space before the @, or mailto: left at the front.

Do not write your own regular expression for this. The real rules are long and odd, and home-made patterns usually reject valid addresses like [email protected]. Use your language's built-in validator, such as PHP's filter_var or the HTML type="email" input, and leave the rest to the next checks.

2. The domain's mail server

A domain that receives email publishes MX records in DNS that point to its mail servers. You can look them up yourself:

nslookup -type=mx example.com on Windows, or dig MX example.com on macOS and Linux.

No MX record usually means no email. The standard allows a fallback to the domain's normal address record, so a domain with an A record can technically still receive mail, but in practice most real mail domains have MX records. A domain can also publish a null MX, a single record pointing to ., to say clearly that it never accepts email. Domains that do not exist at all fail this check too, which catches made-up addresses like [email protected].

3. Disposable email domains

Services like Mailinator, Guerrilla Mail and 10 Minute Mail hand out inboxes that disappear within minutes or hours. They have honest uses, but on a sign-up form they mostly mean someone wants the download, discount or trial without hearing from you again. Open lists track thousands of these domains, and new ones appear every week, which is why it matters to check against a maintained list rather than a few names you remember.

4. Role addresses

info@, sales@, support@ and admin@ go to a shared inbox or a group. They are real and fine for B2B enquiries, but they are poor for personal follow-up, more likely to unsubscribe or mark mail as spam, and some email platforms refuse to import them at all.

5. Typos in popular domains

gmial.com, gamil.com, yaho.com, hotmial.com and outlok.com show up in every list of sign-ups. Some of these typo domains even accept mail, so the address "works" and your emails go to a stranger. Comparing the domain with the most common providers and suggesting the fix ("Did you mean gmail.com?") recovers these leads at the moment they are entered.

What you cannot check reliably

Many tools promise to confirm that a mailbox exists by starting an SMTP conversation with the mail server and asking whether it would accept the address. This used to work. Today it mostly does not:

• Gmail, Outlook, Yahoo and most corporate servers accept every address during that conversation and bounce later, so the answer is always "yes".
• Servers that do answer honestly often rate-limit or block the checking server, which then reports "unknown".
• Many hosting providers, including the major cloud platforms, block outgoing connections on port 25 entirely.

So a checker that says a mailbox is "verified" is often guessing. The honest result is the one a careful check gives you: the address is well formed and its domain is set up to receive mail. The only proof that a real person owns an address is double opt-in, a confirmation email with a link they click.

Where to check emails

When you check matters as much as how:

• At the form. Use type="email" on the input for basic format checks in the browser, suggest typo fixes as people type, and validate again on the server, because browser checks are easy to skip.
• Before importing a list. Remove addresses that fail syntax or have no mail server, and decide case by case on disposable and role addresses.
• After sign-up. Send a confirmation email and only treat the address as confirmed once the link is clicked.

Stopping fake emails on your website forms

Most junk addresses arrive through contact forms and sign-up forms, often from bots. Validation catches the broken ones, but bots happily submit perfectly valid-looking addresses. That is why form spam protection matters as much as email validation: a honeypot field, a check on how fast the form was filled in, and limits per visitor stop most automated submissions before you ever see them.

formvoxo does this for any HTML form. Point the form's action at your formvoxo endpoint and you get spam filtering, bot detection and domain whitelisting, with each real submission emailed to you.

Quick checklist

• Validate syntax with a built-in validator, not a home-made regex.
• Look up MX records; no mail server means a guaranteed bounce.
• Check disposable domains against a maintained list.
• Flag role addresses instead of rejecting them outright.
• Suggest fixes for typos in common domains.
• Use double opt-in when you need proof.

To try all of these on a real address, use the free Email Validator.